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Abstract 

In order to beat any type of photon-number-splitting attack, we propose a protocol for quantum 
key distributoin (QKD) using 4 different intensities of pulses. They are vacuum and coherent states 
with mean photon number /x, ^u' and /i^. /x^ is around 0.55 and this class of pulses are used as the 
main signal states. The other two classes of coherent states (/i, are also used signal states but 
their counting rates should be studied jointly with the vacuum. We have shown that, given the 
typical set-up in practice, the key rate from the main signal pulses is quite close to the theoretically 
allowed maximal rate in the case given the small overall transmittance of 10~^. 
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I. INTRODUCTION 



Quantum key distribution(QKD) has drawn much attentions from scientists. Different 
from the classical cryptography, quantum key distribution(QKD) can help two re- 

mote parties to set up the secure key by non-cloning theorem 4 1 . Further, proofs for the 
unconditional security over noisy channel have been given js, 6 



|9|, 



|8|. The security of prac- 
12^. However there are still 



tical QKD with weak coherent states has also been shown 
some limitations for QKD in practice, especially over long distance. In particular, large loss 
of channel seems to be the main challenge to the long-distance QKD with weak coherent 
states. A dephased coherent state |/ie*^) is actually a mixed state of 

P, = ^ r W'){^^^''\<^^ = Y.PM\n){n\ (1) 
27r Jo 

and Pn{^J') = ^ ■ Here /i is a non-negative number. In practice, especially in doing long- 
distance QKD, the channel transmittance r] can be rather small. If < 1 — e^^ — fie~^, 
Eavesdropper (Eve) in principle can have the full information of Bob's sifted key by the 
photon-number-splitting (PNS) attack Eve blocks all single-photon pulses and part of 
multi-photon pulses and separates each of the remained multi-photon pulses into two parts 
therefore each part contains at least one photon. She keeps one part and sends the other 
part to Bob, through a lossless channel. 

If the channel is not so lossy, Alice and Bob can still set-up the unconditionally secure 
final key with a key ratejl^ 

r = 1 - A - H{t) - (1 - A)H{t/{l - A)) (2) 

if we use a random classical CSS codeQ] to distill the final key 12 1. Here t is the flipping error 
rate, A is the fraction of tagged signals^^, i.e. the fraction for those counts in cases when 
Alice sends out a multi-photon pulse. The functional H{x) = —x logg x — {l—x) log2(l — x). 
From the above formula we see that a tight bound for A is rather important in both key 
rate and the threshold of flipping rates. 

It is possible to use single-photon source [l^ in the next generation of practical QKD 
after the technique is fully matured, but it seems not likely in the near future. Moreover, it 
seems not to be the best choice from economic viewpoint. There are at least two realistic 
methods so far: strong-reference-light jl^ method and decoy-state methodjiol. 



2 



Originally, the PNS attack has been investigated where Alice and Bob monitor only 
how many non-vacuum signals arise, and how many errors happen. However, it was then 



shown 15 1 that the simple-minded method does not guarantee the final security. It is 
15l | that in a typical parameter regime nothing changes if one starts to monitor the 



shown 

photon number statistics as Eve can adapt her strategy to reshape the photon number dis- 
tribution such that it becomes Poissonian again. A very important method for was then 
proposed by Hwang jld]. where a method for unconditional verification of the multi-photon 
counting rate (MPCR) is given. Using Hwang's result, one can faithfully estimate the upper 
bound of A through decoy-pulses, given whatever type of PNS attack. The value of up- 
per bound estimated there is much decreased than that in worst-case estimation. However, 
Hwang's method does not produce a sufficiently tight bound, though it is an unconditional 
verification. For example, in the case of fi = 0.3, by Hwang's method, the the optimized 



16|, 



id, 



verified upper bound of A is 60.4%. With the value A = 60.4%. As it was mentioned 
one can combine the decoy-state method with GLLP^^. Bv eqQ, the key rate must be 
low in practice if we use the the bound value given by Hwang ll 611. Latter, Lo and co-workers 

nn n 

studied the subject jl7l.ll8|. However, their main protocol[12[ seems to be inefficient in prac- 
tice, because it requires infinite number of classes of different coherent states to work as 

n 

the decoy states. A detailed version of their main protocol has been presented recent lyjl9|]. 



Prior to Ref. 



17| . a simp 



e idea of using vacuum and very weak cohernet states as decoy 
states was shortly stated 1^: "On one hand, by using a vacuum as decoy state, Alice and 
Bob can verify the so called dark count rates of their detectors. On the other hand, by using 
a very weak coherent pulse as decoy state, Alice and Bob can easily lower bound the yield 
(transmittance) of single-photon pulses." This idea obviously works in the ideal case with 



infinite pulses 



17|. However, as we shall show it latter, given a very lossy channel and finite 



number of pulses, the total number of counts of those very weak coherent states can be too 
small to be useful for a faithful stastical estimation. 



II. OUR PROTOCOL AND RESULTS 

I — I 

Recently, the author proposed an efficient decoy-state protocol 20] with vacuum and two 
coherent states of /i, /i' which are used for both decoy and signal. Here, we propose a modified 
protocol which further improves the key rate. In the modified protocol, coherent states with 
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average photon number //^ is used for the main signal state. Coherent states with average 
photon number /i, /i' are used for both signal and decoy states( i.e., they are used as signal 
states but their counting rates are also observed and used in the protocol.) Vacuum is used 
only for testing. The main idea of this work is: According to the transmittance of the 
physical channel, we first choose a reasonable value for n, e.g. 0.1 or 0.22 and then find 
a good value /i' so that /i and /i' will help to verify a satisfactorily value of transmittance 
of single- photon pulses, si. According to si, we then choose the value /is so that the key 
rate of main signal states is maximized. In a real protocol, Alice is supposed to calculate 
these values according to the transmittance of physical channel in advance. Alice mixes 
all classes of pulses and sends them to Bob and then verify the vahic of the single-photon 
transmittance according to the counting rates of states of vacuum, /i and fi'. If the verified 
value is too much smaller than the expected value, they give up the protocol. Our protocol 
has the following properties: (1), The protocol uses only 4 classes of states. Except for 
vacuum, all pulses have the reasonable intensity and all of them can be used as signal states. 
(2), The protocol gives a key rate ranges from 77% to 88% of that of the theoretically 
allowed key rate, given the overall transmittance of 10~^ or 10~^. (3), The protocol assumes 
typical real-world set-ups of QKD in practice therefore it applies for real-world protocols 
with coherent states. Let's start from an estimation of the theoretically allowed maximum 
key rate (TAMKR) with coherent states. 

A. theoretically allowed maximum key rate 

To see the TAMKR, we consider an ideal protocol: 
Ideal protocol: Alice and Bob exactly uses Ng single-photon pulses to test the transmittance 
and quantum bit error rate(QBER) of all single-photon pulses. The dark count is zero and 
the channel transmittance is r}. They use coherent states to generate the key. Suppose the 
tested QBER is t[ and then they can upper-bound the QBER of those single-photon states 
in signal pulses by 

ti<{l + 5)t[. (3) 
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They use coherent state with intensity /i to generate the key. According to eq.©, the overall 
key rate is 



R = r//i[l - 2H{h) - (1 - e-^){l - H{h))]. 



(4) 



They may choose an appropriate value to maximize R. For example, given ti = 0, 
maximized value is R = ri^e~^ at the point of = 1. In this papeer, we shall consider the 
typical case that the QBER is ti = 0.03 and for this value the TAMKR is 



with /i = 0.572. 

B. elementary results 

In our protocol, the BB84 or other quantum-bit states are encoded in each coherent pulses 
(except for vacuum pulses.) What we shall study is not the BBSA state or other qubit state 
for cryptography itself, we shall only study how to overcome the PNS attack. Alice switch the 
intensity (mean photon number) of each pulse randomly among 4 values, 0, /i, /i', /ig. (These 
values have nothing to do with BB84-state preparation. Except for vacuum, each pulses 
caries a state randomly chosen from BB84-set and there is no relation between intessity 
and the carried BB84-state in any pulse.) We first use the pulses with intensities of /x, /i' 
to estimate a lower bound on the overall transmittance of single photon pulses and then 
calculate the key rate of the main signal states by this lower bound. For simplicity, we 
denote those pulses produced in state l/i^e*^), |/^e*^), |/^'e*^), |0) as class Kj,!^,!^^/ and Yq, 
respectively. In the protocol 6 is randomized. They observe the counting rates of each 
classes so we regard Sq, S^, S^/, S^^ as known parameters and notations Sq, 5^, 5*^', 5*^^ are 
counting rates for pulses in classes of Yq,Y^,Y^i,Y^^, respectively. They verify the lower 
bound of single photon transmittance si using the measured values of so,S^,S^'. With si 
being verified, they can distill the final key from all classes of pulses except for Yq. Given 
the transmittance, not all values of fi, fi' will work same effectively. They should choose 
appropriate values of /i, /x' so that they can verify a large lower bound of si. They should 
also choose an appropriate fig so that the key rate of pulses in this class is maximized. That 
is to say, there are two steps of optimization. First they need good values of fi, fi' to verify 



Rtamkr = 0.14977 



(5) 
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lower bound of si tightly. Second, given si, normally, neither /i nor /i' maximizes the key 
rate, they need to use another intensity of states, fig as their main signal pulses. If there is 
no Eve or Eve hides her presence, after the protocol they must be able to verify everything 
as expected, and they can indeed obtain satisfactory results. If the verified results about 
Si is too much larger than what was expected, they give up the protocol. In this paper, 
the calculation for choosing fi, fi' is similar to my previous workj2o|. but we show something 
more: after adding another class of coherent pulses Y^, the key rate of that class of pulses is 
approaching the theoretically allowed value. 

We first define the counting rate of any state p: the probability that Bob's detector clicks 
whenever a state p is sent out by Alice. We disregard what state Bob may receive here. 



For convenience, we 



This counting rate is called as the yield in other literatures 
always assume 

p' > p; p'e~^' > pe~^ (6) 

in this paper. Alice is the only person who knows which pulse belongs to which class. After 
received all pulses from Alice, Bob announces which pulse has caused a click and which pulse 
has not. At this stage, Alice has already known the counting rates of pulses in each of the 
four classes, {YQ,Y^,Yfj^>,Ys}. Their task is to verify the lower bound of Si, or equivalently, 
the upper bound of A, the fraction of multi-photon counts among all counts caused by pulses 
in class Y^. 

A dephased coherent state \pe^^) has the following convex form: 

p^ = e-nO)(0|+/ie-^|l)(l| + cpe (7) 
and 0=1 — e~^ — pe~^ > 0, 

■1 oo 

Pc = -Y.Pnip)\n){n\. (8) 

^ n=2 



Similarly, state \p'e ) after dephasing is 



p, = e-'^'|0)(0| + p'e-^''\l){l\ + c^^^p, + dpd (9) 

and d = 1 — e~^' — p'e~'^' — c ^2e-^ ^0- Pd is a density operator. (We shall only use the fact 
that d is non-negative and pa is a density operator.) In deriving the above convex form, we 
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have used the fact Pn^jJi') / P2{ij!) > Pn{,lj) / P2{,IJ) for all n > 2, given the conditions of eq.®- 
With these convex forms of density operators, it is equivalent to say that Alice sometimes 
sends nothing (|0)(0|), sometimes sends |1)(1|, sometimes sends pc, sometimes sends pd and 
so on, though Alice does not know which time she has sent out which one of these states. 
In each individual sending, she only knows which class the sent state belongs to. We shall 
use notations sq, 5"^, 5"^', 5"^^, si, Sc, Sd for the counting rates of pulses in class Fq, Yfi', ^s, 
pulses in single-photon state, pulses in state pc and pulses in state pd, respectively. Our 
goal is simply to find a formula relating si or A with the quantities of Sq, S^, S^' which are 
known to Alice and Bob already. Given any state p, nobody but Alice can tell whether it is 
from class or Y^i. Asymptotically, we have 

s,{p) = s,{p') (10) 

and Sp{p), Sp{p') are counting rates for state p from class and class Y^i, respectively. 

The coherent state p^' is convexed by pc and other states. Given the condition of eq.®, 
the probability of pc in state p^' is larger than that in p^. Therefore we can make a prelim- 
inary estimation of Sc- From eq.Q we immediately obtain 

Sp> = e ^ So + p'e ^ si + c— — -Sc + dsd- (11) 
So is known, si and Sd are unknown, but they can never be less than 0. Therefore we have 

e-'^'so + p'e-^'si + c^^^^s, < S^,. (12) 

From eq.Q we also have 

e-'^so + pe"^si + cSc = S^. (13) 

Solving the above two constraints self-consistantly we have 

A = — < ^ ( -l] + 

Sp ~ p' - p \p'e-^''Sp j p'Sp 

= l^^^±^^e^S,. (14) 

p 

In particular, in the case rj «1 and there is no Eve., Alice and Bob must be able to verify 
the following facts: 

si = e^{l - A)r] + [(1 - A)e^ - l]so/p (15) 



and, if we set /i' — — we have 



A 




1) 



/i 



(16) 



in the protocol. (In eq. ()16|) we have set Sq = for the clarity of the main issue. This is 
close to the real value in the case of normal lossy channel, which is 1 — e~^, given that 
7] « 1. From the above observation we can summarize two points: (1), Assymptotically, 
should be chosen close to each other so as to obtain a tight lower bound for Si. (2), 
The over estimation of A by our protocol is /i — (1 — e~^) = /i^/2. Therefore, the smaller 
fi is chosen, the tighter our verification of A, si is. However, we can not choose to set fi or 
— to be unlimittedly small in practice, otherwise the protocol is neither stable nor secure 
due to the statistical fluctuation. The results above are only for the asymptotic case. In 
practice, the number of pulses are always finite and negative effects from possible statistical 
fluctuation have to be considered. Otherwise, the protocol is insecure. Before going into 
details of such a task, we give an example to see why the fluctuation can cause serious 
security problem if it is disregarded. Consider a toy protocol: Alice and Bob use single- 
photon state as the decoy state to test si and use normal coherent state for key distillation. 
Suppose the total number of pulses of decoy states is 10^ and they find 20 clicks at Bob's side 
for all decoy pulses. If they conclude that si = 2 x 10~^ the protocol is very insecure: there 
is substentially non-negligible probability that the real value of Si for signal pulses is only 
a half of that. Similar problem also occurs in the idea of Ref. jisl] where very weak coherent 
state 18] is used to replace the single-photon decoy state. Obviously, to lower bound the 
value of Si by observing the counting rate of the very weak coherent states, the mean photon 
number /i^, of the very weak coherent states must be less than rj. Suppose we use 10^° pulses 
for the decoy pulses of then in average the total counts of the very weak coherent states 
is ^7] < rf. Given channel transmittance of r/ = 10~^, in average, there would be only less 
than 100 counts for the decoy pulses of very weak coherent states. This seems insufficient to 
make a faithful stastical estimation for the true value of Si. Moreover, in practice, the dark 
counts will make things even worse. Suppose they use a number of vacuum states class Yq 
to test the dark count rate. Suppose in class Iq, the tested dark count rate is sq = 10~^. 
Suppose there are 10^° pulses in class of very weak coherent state. In average, they should 
find 10100 counts for this class, 10000 dark counts and 100 counts caused by the very 
weak coherent states. However, this is only the values in average. In a specific realization, 
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they will have no way to verify anything. For example, if they observe 10100 counts for 
among lO^'' pulses of very weak coherent states, there is a non- negligible probability that 
all these counts are due to the dark counts only while the single-photon state counting rate 
is actually zero. The idea^^ of using very weak coherent state as decoy state will require 
an unreasonably large number of pulses for a faithful statistical estimation j2l|. Besides the 
issue of statistical fluctuation, exactly producing the expected very weak coherent states 
itself can be technically difficult. Now we show how our protocol works in practical set-ups. 



C. numerical results of the protocol 

In practice, our task is stated as this: to verify a tight lower bound of si and the proba- 
bility that the real value of si for signal pulses in any class being less than the verified lower 
bound is exponentially close to 0. 

The counting rate of any state p in class now can be slightly different from the counting 
rate of the same state p from another class, 1^, with non-negligible probability. We shall use 
the primed notation for the counting rate for any state in class Y^r and the original notation 
for the counting rate for any state in class Y^. Explicitly, eq. ()12ll3|) are now converted to 

{e-f'so + yue"^si + cSc = S^, 
cs',<^{S,'-l^'e-'^'s[-e-'^'s',). 

Setting = (1 — r^)^^. for x = l,c and Sq = (1 + ro)so we obtain 

A < pe'''S^,/S^ - /e^ + [{p' - p)so + r,si + roSo]/S^. (18) 

In the left side, if p' and p are too close, the factor of A is very small. In the right side, if 
p' — pis too small, term riSi will contribute effectively. Therefore, in practice, p' and p have 
to be a bit different. The important question here is whether there are reasonable values 
for yu', p so that our protocol can verify a tight lower bound of Si even though the number 
of pulses is finite. The answer is yes. Now the problem is actually this: given the normal 
case that they have found = rjp, 5^/ = rjp', (i.e., there is no Eve.), how tightly they can 
lower bound Si. Given Ni +N2 copies of state p, suppose the counting rate for Ni randomly 
chosen states is Sp and the counting rate for the remained states is s'p the probability that 
Sp — s'p > 6p is less than exp (^—jSp'^No/sp^ and Nq = Min(A''i, A^2)- Now we consider the 



p'e" 



;i-rc)^-i 
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TABLE I: Verification of transmittance of single-photon pulse. We need the pulses in class 
Yo,Y^,Yfj,' for verification. Class or Y^i need 10^'' pulses and Yq needs 2 x 10^. 



rj 


10-3 


10-3 


10-4 


10-4 


So 


10-6 


2 X 10-^ 


10-6 


2 X lO-'^ 




0.1 


0.1 


0.22 


0.1 




0.27 


0.26 


0.48 


0.35 


sih 


0.958 


0.969 


0.821 


0.922 



difference of counting rates for the same state from different classes, and Y^i. To make a 
faithful estimation for exponentially sure, we require Sp^No/sp = 100. This causes a relative 
fluctuation 

The probability of violation is less than e~^^. To formulate the relative fluctuation ri,rc by 
Sc and si, we only need check the number of pulses in state pc, in each classes in the 

protocol. That is, using eq. lfTIH) . we can replace ri,rc in eq. (fT7|) by lOe^/^y^^^^, lOy^^^^, 
respectively and is the number of pulses in class F^. From this we can also see that value 
/i itself cannot be set too small, otherwise the total number of single-photon pulses is too 
small therefore the fluctuation is severe. Since we assume the case where vacuum-counting 
rate is much less than Sp, we shall omit the effect of fluctuation in vacuum counting, i.e., we 
set ro = 0. With these inputs, eq. ()17|) can now be solved numerically. The verified bound 
values of Si are listed in the following table I. They are values that can be verified in the 
case that there is no Eve (or Eve hides her presence). In obtaining those values, we first 
choose a reasonable value for fi. According to fi, we choose an appropriate fi' therefore a 
tight bound for Si is obtained. Next, we shall consider the QBER. For a fair comparison 
of the ideal protocol and our protocol, we assume the same channel and the same device 
for both protocol. Therefore the bit-flip part should be equal. The bound of phase-flip rate 
of our protocol should be larger than that in the ideal protocol, because here we have to 
assume all phase-flip errors have happened to the single-photon pulses. If the QBER in ideal 
protocol is E, then the phase-flip in our protocol is 



E'<fE-J = e^r]/s,. 
10 



(20) 



TABLE II: Final key rate. The last raw is the ratio of key rate from main signal pulses and the 
theoretically allowed maximal value. We have assumed the QBER for signal states in the Ideal 
protocol is bounded by t = 3%. The number of pulses of in Yg can be any number larger than 10^''. 





10-3,10-6 


10-3,2 X 10-"^ 


10-^,10-6 


10-^,2 X 10"^ 




0.1,0.27 


0.1,0.26 


0.22,0.45 


0.1,0.35 


Sl{lJ's)/V 


0.958 


0.969 


0.821 


0.922 


fJ-s 


0.550 


0.555 


0.478 


0.535 


R/ Rtamkr 


88.0% 


92.0% 


57.3% 


80.8% 



Using eq.(j2I) we have the formula for key rate on class Yg-. 

Rg = 5^J1 - HiE) - H{fE) - A,(l - HifE))]. (21) 
and S^^ is verified to be rjfig, E is the meassured error rate of the main signal pulses, 

Ag = l-^^e-''\ (22) 

Tj 

We shall assume that E is bounded by 3%, the same with ti in the ideal protocol. The key 
rates for class Y, in various cases is listed in table II. 



III. CONCLUSION 

In conclusion, we have proposed an efficient and feasible decoy-state method to do QKD 
over very lossy channel. The key rate for the main signal pulses is around 57% — 92% of the 
theoretically allowed maximal value. Our protocol uses vacuum and coherent states with 
intensities of /is. All coherent states can be used to distill the final key and fig is used 
as the main signal pulses. As one may see from table I, the key rate of our protocol is rather 
close to that of the ideal protocol. We believe the protocol shown here is the best choice 



among all existing decoy-state protocols 
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